{"id":"CVE-2026-114160","published":"2026-11-10T19:19:09.527","lastModified":"2026-11-11T02:17:08.860","description":"Server-side request forgery (ssrf) in Azure Managed Grafana allows an unauthorized attacker to elevate privileges over a network.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114160","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A server-side request forgery (SSRF) vulnerability in Azure Managed Grafana allows unauthenticated remote attackers to manipulate the application into making unintended internal network requests, leading to privilege escalation. This occurs due to insufficient validation of user-supplied URLs used in backend HTTP requests.","exploitability":"Exploitation requires no authentication or user interaction and can be performed remotely over the network with low technical complexity, assuming the attacker can submit malicious input to a vulnerable endpoint.","blast_radius":"Successful exploitation could enable full compromise of confidentiality, integrity, and availability of the affected system and potentially downstream internal services accessible to the Grafana instance.","remediation":"Upgrade to Azure Managed Grafana version 2.590 or later, as this is the minimum version that includes the fix for CVE-2026-114160.","detection":"Defenders should monitor for anomalous outbound HTTP requests from the Grafana service to internal IP ranges (e.g., 10.x.x.x, 172.16.x.x–172.31.x.x, 192.168.x.x) or metadata endpoints (e.g., 169.254.169.254), especially when such requests correlate with user-initiated API calls involving URL parameters or dashboard imports.","tags":["ssrf","privilege-escalation","azure","grafana","network","web"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:50:30.821Z"}}